labeler: parse yes/no template fields, keep legacy checkbox fallback

[bryanbeverly]

Summary

The PR template's Review guidance section is switching from checkbox syntax (- [ ] **Urgent** ...) to a yes/no value (- **Urgent** (needs same-day review): no). GitHub treats every - [ ] line as a task and rolls them into the "X of Y tasks" indicator on the PR list view, which makes the indicator misleading -- a normal PR could never read 100% complete unless the bug happened to be both Urgent and High complexity.

This is the labeler half of the rollout. The companion template changes ship in trufflesecurity/.github-private and trufflesecurity/thog.

What changed

pr_labeler.py:

• New field_state(body, *, yesno, checkbox) helper. Tries the new yes/no regex first; falls back to the legacy checkbox regex.
• New yesno_regex(keyword) matches - **Urgent** (...): yes|no (case-insensitive, with word-boundary guards so values like nothing don't get parsed as no).
• Existing checkbox_regex(keyword) is retained so in-flight PRs opened before the template change still get labeled correctly.
• Reconcile loop pairs both regexes per label.

test_pr_labeler.py:

• New TestFieldStateYesNo class with parametrized yes/no variants, value validation, and parenthetical-hint edge cases.
• Existing TestCheckboxState cases are preserved as TestFieldStateLegacyCheckbox.
• New TestFieldStatePrecedence class confirms yes/no wins when both formats appear in the same body.
• Reconcile-level coverage for both formats.

54 total tests pass (was 22).

Review guidance

• Urgent (needs same-day review): no
• High complexity (non-obvious logic, careful review): no
• Estimated review time: 5-10 min
• Key files to focus on: .github/scripts/pr_labeler.py (regex + field_state)
• Areas you're unsure about: None

Testing

Verified locally with pytest .github/scripts/test_pr_labeler.py -v -- 54 passed. ruff check and ruff format --check both clean.

Deployment notes

None. Pure script + tests change; reusable workflow caller signature is unchanged. The legacy regex stays in for ~2 weeks; a follow-up will drop it once the open-PR queue rolls over.

---

Note

Medium Risk
Changes PR labeling behavior by switching parsing from checkbox-only to yes/no template fields, which could cause incorrect review/urgent/complexity/high labels if the new regex misses edge cases. Scope is limited to a GitHub Actions helper script and expanded unit tests.

Overview
Updates the PR labeler to derive review/urgent and complexity/high from the new PR template format - **Field**: yes|no, while retaining legacy checkbox parsing as a fallback for older PRs.

Introduces a new field_state helper and anchored yes/no regexes with defensive handling to avoid mis-parsing : yes/no text inside legacy checkbox descriptions, and expands the test suite to cover yes/no variants, legacy behavior, and precedence/edge cases.

^{Reviewed by Cursor Bugbot for commit b648472. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 3f53db2. Configure here.}

[bryanbeverly]

If you are the lucky person reviewing this, could you please also check these? They are all related to this one issue. The .github-private PR and the thog PR 6133 both update the actual PR template referred to in this PR. The final thog PR 6134 provides extra clarity for future agents in the project-wide rules.

• https://github.com/trufflesecurity/.github-private/pull/7
• https://github.com/trufflesecurity/thog/pull/6133
• https://github.com/trufflesecurity/thog/pull/6134